Commit 5c8f91d8 authored Oct 09, 2024 by Alexey Dobriyan Committed by Gu Bowen Oct 09, 2024

ELF: fix kernel.randomize_va_space double read

stable inclusion
from stable-v6.6.51
commit 53f17409abf61f66b6f05aff795e938e5ba811d1
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9NT
CVE: CVE-2024-46826

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=53f17409abf61f66b6f05aff795e938e5ba811d1



--------------------------------

[ Upstream commit 2a97388a807b6ab5538aa8f8537b2463c6988bd2 ]

ELF loader uses "randomize_va_space" twice. It is sysctl and can change
at any moment, so 2 loads could see 2 different values in theory with
unpredictable consequences.

Issue exactly one load for consistent value across one exec.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Link: https://lore.kernel.org/r/3329905c-7eb8-400a-8f0a-d87cff979b5b@p183


Signed-off-by: Kees Cook <kees@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Gu Bowen <gubowen5@huawei.com>

parent 5d76abff

fs/binfmt_elf.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -1008,7 +1008,8 @@ static int load_elf_binary(struct linux_binprm *bprm)
		if (elf_read_implies_exec(*elf_ex, executable_stack))
		current->personality \|= READ_IMPLIES_EXEC;

		if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
		const int snapshot_randomize_va_space = READ_ONCE(randomize_va_space);
		if (!(current->personality & ADDR_NO_RANDOMIZE) && snapshot_randomize_va_space)
		current->flags \|= PF_RANDOMIZE;

		setup_new_exec(bprm);
		@@ -1300,7 +1301,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
		mm->end_data = end_data;
		mm->start_stack = bprm->p;

		if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
		if ((current->flags & PF_RANDOMIZE) && (snapshot_randomize_va_space > 1)) {
		/*
		* For architectures with ELF randomization, when executing
		* a loader directly (i.e. no interpreter listed in ELF